From 05381f00d25e380c557a3a1100dd83e75298f130 Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Thu, 20 Jun 2019 15:23:06 +0200 Subject: [PATCH] Fall back to black for non-color values Signed-off-by: Joas Schilling --- core/Controller/SvgController.php | 1 + lib/private/Template/IconsCacher.php | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/core/Controller/SvgController.php b/core/Controller/SvgController.php index bbf4e61c60..b956f724ad 100644 --- a/core/Controller/SvgController.php +++ b/core/Controller/SvgController.php @@ -111,6 +111,7 @@ class SvgController extends Controller { * * @param string $path * @param string $color + * @param string $fileName * @return DataDisplayResponse|NotFoundResponse */ private function getSvg(string $path, string $color, string $fileName) { diff --git a/lib/private/Template/IconsCacher.php b/lib/private/Template/IconsCacher.php index 9cd4f8bca1..dd83ce7877 100644 --- a/lib/private/Template/IconsCacher.php +++ b/lib/private/Template/IconsCacher.php @@ -184,6 +184,11 @@ class IconsCacher { * @return string */ public function colorizeSvg($svg, $color): string { + if (!preg_match('/^[0-9a-f]{3,6}$/i', $color)) { + // Prevent not-sane colors from being written into the SVG + $color = '000'; + } + // add fill (fill is not present on black elements) $fillRe = '/<((circle|rect|path)((?!fill)[a-z0-9 =".\-#():;,])+)\/>/mi'; $svg = preg_replace($fillRe, '<$1 fill="#' . $color . '"/>', $svg);